Bug 1413908 (CVE-2016-10140)

Summary:	CVE-2016-10140 zoneminder: Information disclosure and authentication bypass
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WORKSFORME	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	carnil, cra, fedora
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-01-18 15:50:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	1413909
Bug Blocks:

Description Andrej Nemec 2017-01-17 10:04:45 UTC

Information disclosure and authentication bypass vulnerability exists
in the Apache HTTP Server configuration bundled with ZoneMinder
v1.30.0, which allows a remote unauthenticated attacker to browse all
directories in the web root, e.g., a remote unauthenticated attacker
can view all CCTV images on the server.

Upstream bug:

https://github.com/ZoneMinder/ZoneMinder/pull/1697

Comment 1 Andrej Nemec 2017-01-17 10:05:22 UTC

Created zoneminder tracking bugs for this issue:

Affects: fedora-all [bug 1413909]

Comment 2 Charles R. Anderson 2017-01-18 15:50:00 UTC

Fedora 26/rawhide not affected.  zoneminder has been retired from master because it is moving to RPM Fusion.

Fedora 25 not affected.  zoneminder-1.28.1-6.fc25 has:
./etc/httpd/conf.d/zoneminder.conf:    Options -Indexes +MultiViews +FollowSymLinks

Fedora 24 not affected.  zoneminder-1.28.1-5.fc24 has:
./etc/httpd/conf.d/zoneminder.conf:    Options -Indexes +MultiViews +FollowSymLinks